Update from the Business Continuity Working Group

Transcription

1 26 June 2013 Performance and Resources Board 22 To consider Update from the Business Continuity Working Group Issue 1. The Business Continuity Working Group oversees the development, maintenance and improvement of the GMC s business continuity plans and the associated business continuity management system. We are working towards aligning these plans with the new relevant standard ISO 22301: The Group has produced an updated Terms of Reference document which includes recent changes to our governance arrangements and defines the responsibilities of the Group as required by the new ISO standard. 3. The Business Continuity Policy document and Business Continuity Policy Summary statement have also been amended to reflect these requirements. Recommendations 4. The Performance and Resources Board is asked to: a. Note the work of the Business Continuity Working Group (BCWG). b. Approve the updated Terms of Reference for the BCWG. c. Approve the updated Business Continuity Policy and Business Continuity Policy Summary statement.

2 Issue 5. The Business Continuity Working Group (BCWG) is responsible for providing management direction and support during the creation of the Business Continuity Management System (BCMS) and its subsequent development and maintenance. This work is necessary to ensure that we can respond effectively in the event of a disruption to normal operations. 6. The Business Continuity Policy sets out the scope and wider framework within which we will develop our existing plans and align them to the ISO 22301:2012 standard. It affirms our commitment to continual improvement of the BCMS and in its summary form is available to any external interested parties. 7. The Board is asked to consider proposed changes to reflect the new governance arrangements and ISO standard. The work of the BCWG 8. The BCWG meets bi-monthly and over the last 12 months has overseen a programme of work to improve the existing plans, develop awareness of business continuity across the GMC, and develop a business continuity management system to align with the ISO standard. 9. We have business continuity and pandemic plans in place both of which have been updated and approved by the BCWG twice in the last twelve months. As plans are updated they are tested. Scenario based exercises and workshops facilitated by external consultants Glen Abbot are run annually. In May 2013 an exercise was held for the MPTS incident management team using their new plan. The report on this exercise will be reviewed by the BCWG and recommendations for change implemented. These exercises provide an opportunity for training and form part of the checking process that documentation is fit for purpose. 10. The Group is planning further developments, using the BCMS approach, to achieve a higher level of integration into the business at all levels through training and continual improvement. As part of this development work we have put in place the following mechanisms for communicating with staff in the event of an incident: a. A major incident line where staff can access recorded messages. b. A system for sending a text message to all staff from a central point. c. Regular articles on Inside Info have been used to keep staff up to date on developments and to provide advice. d. A printed leaflet about our business continuity planning with a pull off reference card was issued to all staff and is now issued by HR to all new starters. 2

3 11. Communication during an incident is key and a communication strategy document has been developed recently approved which will underpin all the plans as we enhance these. 12. The BCWG identifies and reviews any external risks with the potential to disrupt operational activity or affect staff wellbeing. Where necessary, strategies to reduce any impact are then developed and recommended to directors or other senior managers. Recent examples include: a. The advance planning that was put in place for the 2012 Olympic Games. b. Communication to staff in advance of planned travel disruption due to strikes, local demonstrations or predicted severe weather. c. Power failure to our Centurion House and Belfast offices. d. Disruption caused by suspect packages near to our Belfast and Manchester offices. 13. The BCWG has a standing agenda item to review any incidents where business was, or could have been, interrupted or staff affected to see whether there are any lessons to be learned for future planning. BCWG Terms of reference document 14. The BCWG has been working to terms of reference agreed in June Since the Group was first established we have worked to put in place a comprehensive set of documentation to support a systematic business continuity management system (BCMS) modelled upon the BS25999 standard. Our programme of work for 2013/2014 includes aligning our BCMS with the new ISO 22301:2012 standard. 15. The terms of reference for the BCWG have been updated (at Annex A), including: a. To address the requirements of the new standard and the changes in our governance arrangements. b. To more explicitly define the role that the Group will have in supporting the development and subsequent monitoring of implementation of the business continuity management system (BCMS). The International Standard applies the Plan-Do-Check-Act lifecycle model to an organisation s BCMS. These requirements are set out as responsibilities for the Group in the updated terms of reference document. 3

4 Business Continuity Policy and policy summary statement 16. The Business Continuity Policy and policy summary statement, first issued in June 2011, were reviewed by our external business continuity consultants against the requirements of the new ISO standard and a gap analysis produced. The new standard required that certain aspects of our planning, including communication and document management, were more explicitly covered. The updated documents include these and other minor changes. The revised policy document is attached at Annex B and the summary policy statement at Annex C. Once approved and signed, the policy summary statement can be issued to any external interested party. 17. These changes to documentation will not impact on the resource requirements. The business continuity policy includes specific reference to our strategic aims, our legal and statutory obligations and ensuring that the interests of key stakeholders are supported. 4

5 Supporting Information How this issue relates to the corporate strategy and business plan 18. Strategic aim 7: To continue to use our resources efficiently and effectively. Primary activity: ensure that the organisation has up to date and relevant Business Continuity Plans. If you have any questions about this paper please contact: Steve Jones, Head of Facilities,

6 22 Update from the Business Continuity Working Group Annex A Business Continuity Working Group Terms of Reference A1

7 Business Continuity Working Group Terms of Reference Author Sheila Tuffrey Version 4.2 Issue Date Under review Review Date File Location Document: Livelink Pdf: Intranet A2

8 Table of Contents Introduction... 4 Background... 4 Scope... 4 Responsibilities... 4 The Business Continuity Working Group... 5 Membership... 5 Responsibilities of the BCWG... 5 Document Version History... 7 A3

9 Introduction 1. The purpose of this document is to formalise the roles and responsibilities of the Business Continuity Working Group (BCWG). Background 2. The GMC has a Business Continuity Policy which sets out the framework within which it develops sustainable business continuity plans and will align its existing plans to the ISO22301:2012 standard. This is achieved through the development and maintenance of a Business Continuity Management System (BCMS) involving a process of continual improvement. This planning is necessary to ensure the GMC can respond effectively in the event of a disruption to normal operations. 3. The BCWG provides management direction and support during the creation of the BCMS and its subsequent development and maintenance. The work of this Group will enable the GMC to be assured that appropriate actions will be taken in the event of unplanned business interruption and that potential threats are reviewed. 4. The objective is to create a formal set of documentation to support this systematic approach to the management of the business continuity process. A BCMS establishes, implements, operates, monitors, reviews, maintains and improves business continuity planning. 5. The plans themselves are a documented collection of procedures and reference material which are created and maintained in readiness for use in an incident. The management system is to provide assurance that these plans are fit for purpose. Scope 6. This document details the terms of reference of the BCWG, its composition and its role in the BCMS. Responsibilities 7. The Director of Resources and Quality Assurance is responsible for Business Continuity issues and will take responsibility for ensuring that the BCWG operates in accordance with these Terms of Reference. The BCWG is accountable to the Performance and Resources Board and the Director will refer matters as necessary. The Board is comprised of the Chief Operating Officer and Directors. 8. The GMC Facilities Project Manager responsible for business continuity will ensure that this document is relevant and up to date and be known as the Business Continuity Manager (BC Manager) in business continuity documentation. The BC Manager will manage all document control. A4

10 The Business Continuity Working Group Membership 9. The BCWG will include representatives from all business areas but the primary group are those who are responsible for functions where critical activities or support to those activities has been identified. The membership includes: Director of Resources and Quality Assurance (Chair) Assistant Director Information Systems Head of Facilities Assistant Director Human Resources Head of IS Operations Assistant Director from Registration and Revalidation Assistant Director from Strategy and Communication Assistant Director from Fitness to Practise Assistant Director from Education and Standards Tribunal Clerk Medical Practitioners Tribunal Service GMC Facilities Projects Manager (in role as BC Manager) 10. The Director of Resources and Quality Assurance will chair the Group. Meetings 11. The BC Manager will ensure the minutes are taken and circulated with an agenda to all attendees. The Group will meet bi-monthly. Responsibilities of the BCWG 12. The Business Continuity Working Group supports the business continuity management framework in operation under ISO 22301:2012. The key responsibilities of the Group include the following points and align with the Plan, Do, Check, Act lifecycle of the management standard: Plan Do Develop business continuity policies, strategies, plans and procedures Develop a reporting schedule for the management reviews and audits Ensure that business continuity policies, strategies plans and procedures are implemented. Support the BC Manager responsible for coordinating the implementation of business continuity Ensure that all staff are aware of the BCM Policy Horizon Scan so that any emerging risks, issues or changes to legislation, regulation and interested party management can be incorporated into the necessary parts of the BCMS A5

11 Ensure that all necessary roles for the development, maintenance and review of the BCMS are allocated and training is given Identify all critical suppliers and ensure their BC arrangements are reviewed Implement a safe and secure documentation storage medium for the BCMS Check Act Approve business continuity policies, strategies, plans and procedures. Review status reports covering business continuity implementation, exercising, training, post-incident reports, risk management and corrective actions Implement corrective actions arising from implementation, risk management, post-exercise reviews, post-incident reviews, management reviews and internal audit Recommend changes to policies, strategies, plans and procedures based on business continuity incidents and changes in risks. Promote and manage continual improvement of the BCMS process A6

12 Document Version History Version Status* Author Reason for issue Date 4.0 Agreed by Sheila Tuffrey Creation 3 June 2011 BCWG 4.1 Draft Sheila Tuffrey Changes in April/May 2013 organisation and maturity of BC 4.2 Draft Sheila Tuffrey Changes requested by BCWG 15 May 2013 *e.g. Draft, for comment, issued Sign off Reviewed by Method How approved Maintenance and Review Date of Review Action Required Responsible person Distribution List Version Names Position/ Organisation Method of Issue Notes: All personnel listed above receive copies, or are notified, of updated versions of the document. Any other copies provided to third parties are not subject to automatic update A7

13 22 Update from the Business Continuity Working Group Annex B Business Continuity Policy B1

14 Business Continuity Policy Author Sheila Tuffrey Version 1.2 Issue Date under review Review Date File location Document: Livelink PDF: Intranet B2

15 Table of Contents Business Continuity Management Policy... 4 Purpose... 4 Scope... 4 Business Continuity Management System (BCMS) Objectives... 4 Business Continuity Requirements... 5 Organisational Objectives and Obligations of the GMC... 6 Risk Evaluation and Risk Appetite... 6 Legal and Statutory Obligations... 7 Stakeholders... 7 Key Services... 8 Top Management Commitment and Allocation of Responsibilities... 8 Policy Review Date... 8 Related Documents... 8 Glossary... 9 British Standard Definitions... 9 Other Abbreviations... 9 Document Management Document Control B3

16 Business Continuity Management Policy Purpose 1. The General Medical Council is committed to developing, maintaining and improving a Business Continuity Management System (BCMS) that enables it to deliver key services to stakeholders in the event of a disruption. This system will be developed with due regard to the GMC business objectives, statutory obligations and levels of risk acceptance. 2. The GMC Business Continuity Management (BCM) Policy sets out the framework within which the GMC develops sustainable business continuity plans and will develop its existing plans to align with the new standard ISO22301:2012. This is achieved through the development of a BCMS involving a process of continual improvement. This planning is necessary to ensure that the GMC can respond effectively in the event of a disruption to normal operations. Scope 3. This policy applies to all GMC and MPTS staff and their activities at the three main GMC sites listed below: 350 Euston Road, London 3 Hardman Street, Manchester St James s Buildings, Manchester 4. This policy also applies to services provided by GMC staff working at the devolved offices or elsewhere but for business continuity planning purposes the premises are excluded and staff will either transfer their work to the one of the larger sites or work from home until alternative premises can be sourced. 5. This policy provides guidance for the resumption and recovery of time sensitive business operations in accordance with their designated priority as critical activities in support of key services as well as ensuring that adequate plans are in place for the less time sensitive business operations. Business Continuity Management System (BCMS) Objectives 6. The objective of the BCMS is to ensure the GMC s strategic aims are not compromised in the event of disruption. 7. In developing a BCMS the GMC will: a. Reduce the risks which otherwise could lead to business interruption b. Develop Business Continuity Plans which enable the GMC to maintain continuity of service following a business interruption and reduce the impact of such a disruption for our stakeholders in accordance with the agreed recovery time set out in business continuity plans. B4

17 c. Exercise, maintain, review and improve the Business Continuity Plans to ensure they remain fit for purpose and are appropriate to the current aims and objectives of the GMC d. Provide the resource needed to establish, operate, maintain and improve the BCMS Business Continuity Requirements 8. The GMC s business continuity management policy provides a framework through which the following BC requirements will be met. a. A comprehensive Business Continuity Management Systems (BCMS) is established and maintained following the requirements of ISO b. Business impact analysis and risk assessment will be applied to our key services and their supporting activities systems, process and resources c. The GMC will maintain a Business Continuity Risk Register (BCRR) in order to reduce the likelihood of a disruption and improve resilience. The Corporate Risk Register and the Information Security Register will be monitored for any business continuity related risks which will be reviewed and if necessary included in the BCRR. Unresolved significant or critical risks will be escalated to the BCWG prior to each meeting. d. A Business Continuity Strategy will be developed which will determine the most appropriate methods by which to recover the critical activities and resources within the recovery time objectives following a business interruption. e. Based on the BC Strategy, operational and management plans will be developed that detail how critical activities and their supporting resources will be recovered within their recovery time objectives. These plans will also detail how the incident will be managed. f. Plans are subject to an ongoing exercise programme, continuous review and improvement, so that all stakeholders, including senior managers, can be assured that the BCMS remains up to date relevant and effective. g. Each department will carry out reviews of their business continuity plans at least annually. This will be facilitated and monitored by the Facilities Manager who has the role of Business Continuity Manager. h. Contracts with suppliers of critical goods and services to the GMC must include a requirement for the supplier s business continuity process to be approved to the satisfaction of GMC i. All staff must be made aware of the plans that affect their Directorate or section and their role following a BCP invocation. B5

18 Organisational Objectives and Obligations of the GMC 9. The strategic aims for the GMC for 2013 are as follows: To continue to register only those doctors that are properly qualified and fit to practise and to increase the utility of the medical register. To give all our key interest groups confidence that doctors are fit to practise. To provide an integrated approach to the regulation of medical education and training through all stages of a doctor s career. To provide doctors with relevant up-to-date guidance on professional standards and ethics. To develop more effective relationships with delivery partners in order to achieve an integrated approach to medical regulation in the UK. To help shape the local, UK, European and international regulatory environment through effective engagement with decision-makers, other regulators and key interest groups. To continue to use our resources efficiently and effectively. To deliver evidence-based policies that demonstrate better regulation principles, and promote and support equality and diversity. Risk Evaluation and Risk Appetite 10. The Business Continuity Risk Management procedure is complementary to the Risk Management Framework set out by the GMC as part of the internal control and corporate governance arrangements. 11. The procedure enables the organisation to understand the threats and vulnerabilities of its critical activities underpinning the key services and the potential impact caused by a business interruption. 12. Risk evaluation establishes whether risks are adequately mitigated and, if not, determines what additional action is required to reduce their impact or likelihood of occurrence. In each case, we define the level of residual risk that is acceptable. 13. Risk appetite is therefore established on a risk-by-risk basis by defining the level of residual risk that is tolerable and justifiable once mitigating action has been taken. 14. Using these factors, we identify risks that are not adequately mitigated and determine what additional measures are required. Where the residual risk is still considered significant or critical, the procedure details an escalation procedure for further evaluation. B6

19 Legal and Statutory Obligations 15. The statutory purpose of the GMC is to protect, promote and maintain the health and safety of the public by ensuring proper standards in the practice of medicine. 16. The GMC is the independent regulator for doctors in the UK. Our job is to ensure that patients have confidence in doctors. 17. We aim to secure a regulatory system that: a. Is independent, fair, efficient and effective. b. Raises standards and enhances patient safety. c. Fosters the professionalism of doctors. d. Encourages early and effective local action. e. Commands the confidence and support of all our key interest groups. f. Meets the requirements of the Charities Statement of Recommended Practice (SORP) We remain committed to regulation that puts patient safety first. That regulation must command the confidence and support of our key interest groups. The GMC is also committed to ensuring that it meets all the other legal obligations placed upon any business and employer for example in relation to health and safety, employment, data protection, equal opportunity legislation. 19. The GMC will use its usual communication channels to inform employees and other interested parties of any new or changed legal and regulatory requirements. Stakeholders 20. The interests of key stakeholders are supported by the BCM Policy. Stakeholders are defined as: Doctors Patients and public Employers Government Employees B7

20 Key Services 21. In the event of an incident which prevents us from fulfilling our full range of statutory functions we consider being available to the public and profession to advise, confirm registration status and receive any complaints as a key service and will recover the Contact Centre and GMC website as a priority. 22. We will also ensure that the registration of doctors, and where necessary their removal from the register where they are found unfit to practise, will continue. We will therefore restore the registration enquiry service, investigations function and the running of FTP review and IOP hearings as a priority. Management Commitment and Allocation of Responsibilities 23. The Director of Resources and Quality Assurance is responsible for Business Continuity and will be assisted in this role by the Business Continuity Working Group (BCWG). The BCWG is accountable to the Performance and Resources Board and the Director will refer matters as necessary. This Board comprises the Chief Operating Officer, Directors, and representative Assistant Directors. 24. The role and responsibilities of the BCWG are set out in the Business Continuity Working Group Terms of Reference document. 25. The role and responsibilities for the management of business continuity across the GMC are set out in the Business Continuity Roles and Responsibilities Document. Policy Review Date 26. This policy will be reviewed annually from the date of approval. Related Documents Business Continuity Working Group Terms of Reference Business Continuity Roles and Responsibilities document BC Risk Management Procedure. GMC Risk Management Framework GMC Business Plan 2013 GMC Corporate Strategy B8

21 Glossary British Standard Definitions BCMS: Business Continuity Management System is one that establishes, implements, operates, monitors, reviews, maintains and improves business continuity. BCP: Business Continuity Plan is a documented set of procedures and information that is developed, compiled and maintained in readiness for use in an incident to enable an organisation to continue to deliver its critical activities at an acceptable predefined level. BCM Policy: The Business Continuity Management Policy sets out the GMC management s commitment to BC including the organisations objectives and BC Strategy is the approach by an organisation that will ensure its recovery and continuity in the face of a disaster or other major incident or business disruption. Recovery Time Objective is the target time set for the resumption of the service, or resumption of performance of an activity, or recovery of an IT system or application after an incident. (Note: The recovery time objective has to be less than the maximum tolerable period of disruption) Maximum tolerable period of disruption is the duration after which an organisation s viability will be irrevocably threatened if a service or activity cannot be resumed Other Abbreviations BCWG: Business Continuity Working Group this GMC Group is responsible for the management direction and approval of the BCMS during development phase and subsequent management review once in place. See also terms of reference documentation for further detail. B9

22 Document Management Document storage, access and security 1. All documents comprising the BCMS will be stored securely and centrally on Livelink which is part of the electronic document management system of the GMC. Access to specific documents, ownership and version control will be applied as appropriate to each document. This system is compliant with the ISO27001 standard and managed in accordance with the GMC Information Security Policy. The BCM Policy should not be distributed or transmitted to any other parties without the express permission of the Business Continuity Manager Preservation 2. If the document is out of date (i.e. past its review date) it should be destroyed by secure shredding for paper versions and electronic versions should be deleted. Retrieval and Use 3. This Policy provides the framework and guidance for the Business Continuity Management System and can only be retrieved from Livelink by the Business Continuity Manager, Director of Resources and Quality Assurance or the BCWG. A pdf version is available to staff on the intranet. Control of Changes 4. Uncontrolled modification and revision of content is prohibited and revision procedures should be followed at all times. No changes should be made to the Policy without the agreement from the Business Continuity Manager either as part of the maintenance programme or during an incident. 5. When major revisions are made the document should be saved as the next version number. For minor revisions the version number should be updated by 0.1. Preservation of Legibility 6. The document should be legible at all times and company guidelines for the use of style templates should be followed. Prevention of the Unintended Use of Obsolete Information 7. The Policy should be published with the date on the front page and in the header. It should never be more than 12 months old. Retention and Disposal 8. Old electronic versions of the BCM Policy should be retained for 3 years in Livelink. After this it should be deleted. Paper versions of the BCM Policy should always be current. Old versions should be securely shredded. B10

23 Document Control Version History Revision Status* Author Reason for Issue Date 0.1 Draft for S Tuffrey Creation 7 March 2011 comment 0.2 Revised draft S Tuffrey Comments SJ 14 April 2011 added/jb review 0.3 Clean copy of S Tuffrey For review by 15 April 2011 Draft BCWG 1.0 Agreed S Tuffrey Final agreed version from BCWG 9 May Draft STuffrey For review by BCWG/ Performance and Resources Board 1.2 Draft STuffrey Changes proposed by BCWG * e.g. Draft, for Comment, Issued Review and Sign Off By Method Signature April/May May 2013 Maintenance and Review Date of Review Action Required Year from approval Review content for consistency and currency in particular business objectives and management arrangements. Responsible Person STuffrey Distribution List Version Name Position/Organisation 1.0 All members of BCWG GMC staff members Method of Issue Livelink link by Notes All personnel listed above receive copies, or are notified, of updated versions of the document..any other copies provided to third parties are not subject to automatic update. B11

24 22 Update from the Business Continuity Working Group Annex C Business Continuity Policy Summary Statement C1

25 Business Continuity Policy Summary Statement 1. The GMC exists to protect, promote and maintain the health and safety of the public by ensuring proper standards in the practice of medicine. 2. As an independent regulator for doctors in the UK our job is to ensure patients have confidence in doctors. In order to continue to provide the services which our key interest groups value we have identified the activities which support those services as a priority for recovery in the event of any business disruption. 3. The GMC s Business Continuity policy provides the framework within which we can assure the public that the management procedures in place ensure that we have effective plans which both ensure the safety and welfare of our staff in the event of an incident and that key services are recovered to an acceptable standard as a priority. 4. We consider being available to the public and profession to advise, confirm registration status and receive any complaints as a key service and will recover the Contact Centre and GMC website as a priority. 5. We will also ensure that the registration of doctors, and where necessary their removal from the register where they are found unfit to practise, will continue. We will therefore restore the registration enquiry service, investigations function and the running of FTP review and IOP hearings as a priority. 6. The plans will contain a clear incident management structure and escalation process for the invocation of the plan. 7. There will be a requirement within the plans that communication with key interest groups and staff, is centrally managed to ensure it is factual, appropriate and timely. 8. All members of staff who have a role in recovering critical business activities or management of the incident receive regular and appropriate training. 9. The plans which all form part of the overall BCP are exercised regularly to ensure they are fit for purpose and up to date. 10. Accountability for Business Continuity resides with the Business Continuity Working Group, comprising GMC senior management. C2

26 11. The BCMS is being developed, implemented, reviewed and maintained with the aim of alignment with the ISO 22301:2012 standard. Signed: Paul Philip Chief Operating Officer Date: Issue Date C3 Review Date